PyPI: python

CVE-2022-48566

Safety vulnerability ID: SFTY-20230822-22740

Safety legacy ID: pyup.io-60631

Python 3.6.13, 3.7.10, 3.8.7, 3.9.1 and 3.10.0a3 include a fix for CVE-2022-48566: Observable Timing Discrepancy vulnerability in compare_digest in Lib/hmac.py. The fix includes constant-time-defeating optimizations were possible in the accumulator variable in hmac.compare_digest. https://bugs.python.org/issue40791

PythonPyPINVDNVD
Created at: Nov 5, 2025Updated at: Nov 5, 2025

Overview

Python 3.6.13, 3.7.10, 3.8.7, 3.9.1 and 3.10.0a3 include a fix for CVE-2022-48566: Observable Timing Discrepancy vulnerability in compare_digest in Lib/hmac.py. The fix includes constant-time-defeating optimizations were possible in the accumulator variable in hmac.compare_digest. https://bugs.python.org/issue40791

Advisory

Python 3.6.13, 3.7.10, 3.8.7, 3.9.1 and 3.10.0a3 include a fix for CVE-2022-48566: Observable Timing Discrepancy vulnerability in compare_digest in Lib/hmac.py. The fix includes constant-time-defeating optimizations were possible in the accumulator variable in hmac.compare_digest. https://bugs.python.org/issue40791

Affected Package

Affecting python package, versions
>=3.7.0a1,<3.7.10
>=3.10.0a1,<3.10.0a3
>=3.8.0a1,<3.8.7
>=3.9.0a1,<3.9.1
<3.6.13

Also affects

---

How to Fix

Upgrade
python
to
3.7.10
3.10.0a3
3.8.7
3.9.1
3.6.13
or higher.

Mitigation and Workarounds

---

Vulnerable Functions

Functions linked to known vulnerabilities.

Vulnerable function data is available for Enterprise customers

Book a call with us to see Safety in action.

References

Safety

Verified by Safety

Our Cybersecurity Intelligence Team reviewed this vulnerability. We combine public data with our own research to find issues not yet reported to public sources.

Learn more